Exploit Released for Zero-Day in Internet Explorer
Summary: A working exploit for a previously unknown critical Internet Explorer vulnerability was published online, and Rapid7 added a Metasploit module that attacks IE versions 7, 8 and 9 on Windows XP, Vista and 7. Experts say the flaw was already being exploited in the wild and appears tied to the same group of Chinese hackers behind a pair of Java zero-day exploits from late the previous month, with the vulnerability putting about 41% of Internet users in North America and 32% worldwide at risk.
What's compelling: The attack code was found on a Web server already used by Chinese hackers in targeted attacks, and researchers have linked those sites to the Nitro attacks of 2011, espionage directed against at least 48 chemical and defense companies - so this is a weaponized exploit with a known operator behind it, not a proof of concept.
Read the original at Krebs on Security ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026